Toml Node
Monthly
Denial of service in toml-node versions prior to 5.0.1 allows remote attackers to synchronously block the Node.js event loop by supplying a TOML document containing an extremely long hexadecimal, octal, binary, or decimal integer literal. Because toml.parse() calls BigInt() on the digit sequence before the 64-bit range check runs in reduceInteger(), conversion cost grows super-linearly with digit count, so a single crafted document can stall all concurrent work in the process (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N, availability-only). The flaw is exploitable only where an application parses attacker-influenced TOML; there is no confidentiality or integrity impact, no public exploit code identified at time of analysis, and the issue is fixed in 5.0.1.
Denial of service in toml-node before 5.0.1 allows unauthenticated remote attackers to stall or crash Node.js and browser-based processes that call toml.parse() on attacker-supplied TOML containing long dotted keys, table headers, array-of-tables headers, or inline-table keys. Repeated slicing and rejoining of every path prefix in assign(), deepRef(), and setNestedKey() creates quadratic work that can block the Node.js event loop for several seconds, and sufficiently long paths can terminate the process through memory exhaustion. No public exploit code was identified at time of analysis; impact is confined to availability, with no confidentiality or integrity loss, and the maxDepth option does not mitigate the issue because it limits nesting depth rather than key-segment count.
Prototype pollution in toml-node before 5.0.1 lets an attacker who controls TOML input passed to toml.parse() inject properties into Object.prototype by combining colliding quoted dotted-key bookkeeping with a table-array declaration. The flaw can corrupt objects created elsewhere in the same Node.js or browser process, producing high integrity and availability impact with no confidentiality impact; no public exploit identified at time of analysis.
Denial of service in toml-node before 5.0.1 lets unauthenticated remote attackers stall the Node.js event loop by supplying TOML documents with many distinct [[array-of-tables]] headers, which force quadratic rescans of compiler bookkeeping sets in addTableArray(). The issue is CWE-407 inefficient algorithmic complexity and affects Node.js and browser deployments that call toml.parse() on untrusted input; no public exploit code has been identified at time of analysis.
Uncontrolled recursion in toml-node (npm package `toml`, ~47 million monthly downloads) allows remote unauthenticated attackers to crash any Node.js process that parses attacker-controlled TOML input. The Peggy 5.1.0-generated recursive-descent parser has no depth limit in the mutual recursion between `peg$parsevalue`, `peg$parsearray`, and `peg$parseinline_table_entry`; a ~5-6 KB payload of deeply nested arrays reliably exhausts the call stack and raises an uncatchable `RangeError` that terminates the request worker or process. A confirmed PoC is documented in the GHSA advisory; a patch is available in version 4.2.0 released July 13, 2026.
Prototype pollution in toml-node (npm package `toml` by BinaryMuse) prior to 4.1.2 allows unauthenticated remote attackers to write arbitrary keys onto Object.prototype by supplying a crafted TOML document to `toml.parse()`. The vulnerability exploits a path desynchronization bug in the compiler's duplicate-key guard - comma-joined tracking paths diverge from dot-joined traversal paths, allowing `__proto__` traversal through scalar values into the real JavaScript prototype chain. Injected properties propagate process-wide in Node.js and can enable denial of service, authorization bypass, or code execution via application gadget chains; the GHSA advisory includes working proof-of-concept code, and a fix is available in version 4.1.2.
Denial of service in toml-node versions prior to 5.0.1 allows remote attackers to synchronously block the Node.js event loop by supplying a TOML document containing an extremely long hexadecimal, octal, binary, or decimal integer literal. Because toml.parse() calls BigInt() on the digit sequence before the 64-bit range check runs in reduceInteger(), conversion cost grows super-linearly with digit count, so a single crafted document can stall all concurrent work in the process (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N, availability-only). The flaw is exploitable only where an application parses attacker-influenced TOML; there is no confidentiality or integrity impact, no public exploit code identified at time of analysis, and the issue is fixed in 5.0.1.
Denial of service in toml-node before 5.0.1 allows unauthenticated remote attackers to stall or crash Node.js and browser-based processes that call toml.parse() on attacker-supplied TOML containing long dotted keys, table headers, array-of-tables headers, or inline-table keys. Repeated slicing and rejoining of every path prefix in assign(), deepRef(), and setNestedKey() creates quadratic work that can block the Node.js event loop for several seconds, and sufficiently long paths can terminate the process through memory exhaustion. No public exploit code was identified at time of analysis; impact is confined to availability, with no confidentiality or integrity loss, and the maxDepth option does not mitigate the issue because it limits nesting depth rather than key-segment count.
Prototype pollution in toml-node before 5.0.1 lets an attacker who controls TOML input passed to toml.parse() inject properties into Object.prototype by combining colliding quoted dotted-key bookkeeping with a table-array declaration. The flaw can corrupt objects created elsewhere in the same Node.js or browser process, producing high integrity and availability impact with no confidentiality impact; no public exploit identified at time of analysis.
Denial of service in toml-node before 5.0.1 lets unauthenticated remote attackers stall the Node.js event loop by supplying TOML documents with many distinct [[array-of-tables]] headers, which force quadratic rescans of compiler bookkeeping sets in addTableArray(). The issue is CWE-407 inefficient algorithmic complexity and affects Node.js and browser deployments that call toml.parse() on untrusted input; no public exploit code has been identified at time of analysis.
Uncontrolled recursion in toml-node (npm package `toml`, ~47 million monthly downloads) allows remote unauthenticated attackers to crash any Node.js process that parses attacker-controlled TOML input. The Peggy 5.1.0-generated recursive-descent parser has no depth limit in the mutual recursion between `peg$parsevalue`, `peg$parsearray`, and `peg$parseinline_table_entry`; a ~5-6 KB payload of deeply nested arrays reliably exhausts the call stack and raises an uncatchable `RangeError` that terminates the request worker or process. A confirmed PoC is documented in the GHSA advisory; a patch is available in version 4.2.0 released July 13, 2026.
Prototype pollution in toml-node (npm package `toml` by BinaryMuse) prior to 4.1.2 allows unauthenticated remote attackers to write arbitrary keys onto Object.prototype by supplying a crafted TOML document to `toml.parse()`. The vulnerability exploits a path desynchronization bug in the compiler's duplicate-key guard - comma-joined tracking paths diverge from dot-joined traversal paths, allowing `__proto__` traversal through scalar values into the real JavaScript prototype chain. Injected properties propagate process-wide in Node.js and can enable denial of service, authorization bypass, or code execution via application gadget chains; the GHSA advisory includes working proof-of-concept code, and a fix is available in version 4.1.2.